31ee456329a5ac5bc0e1143979194a8229adc6686b4e707b9acc0ecacd9ecc8f

General

Target

696463d6bd518749d044f65b2a10fc7e_JaffaCakes118.pdf
Size

52KB
MD5

696463d6bd518749d044f65b2a10fc7e
SHA1

22705d986c9d6bf1e5422e283d7455f338cc9dba
SHA256

31ee456329a5ac5bc0e1143979194a8229adc6686b4e707b9acc0ecacd9ecc8f
SHA512

ff3c9f89c12e12c78e9fe8e04d16726cf2502023905d398c1ba2988114a1815339b624b7dffe10c9c015a79373c7ebd1753745e5dd5a2f5b8ac5dff9516dbf2a
SSDEEP

768:GgGzpDFPMc+AmC3xGREjrXPBaAJRt5dIiEllvvbuPyxpDOrjoZlCKeuFzvBBcz+m:TGFJ7ZV34RO5dIia3bQCzvZ89QfrWfkI

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

1216 AcroRd32.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

1216 AcroRd32.exe
1216 AcroRd32.exe
1216 AcroRd32.exe
1216 AcroRd32.exe

pid	process
1216	AcroRd32.exe

pid	process
1216	AcroRd32.exe
1216	AcroRd32.exe
1216	AcroRd32.exe
1216	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 1216 wrote to memory of 4460	1216	AcroRd32.exe	RdrCEF.exe
PID 1216 wrote to memory of 4460	1216	AcroRd32.exe	RdrCEF.exe
PID 1216 wrote to memory of 4460	1216	AcroRd32.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 1396	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 3144	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 3144	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 3144	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 3144	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 3144	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 3144	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 3144	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 3144	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 3144	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 3144	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 3144	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 3144	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 3144	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 3144	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 3144	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 3144	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 3144	4460	RdrCEF.exe	RdrCEF.exe
PID 4460 wrote to memory of 3144	4460	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\696463d6bd518749d044f65b2a10fc7e_JaffaCakes118.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1216

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:4460

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=497D6032A323C446CEF15A96751CE233 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=497D6032A323C446CEF15A96751CE233 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
3⤵
PID:1396

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E8C8376492DBD7D72D6040AD3392FCA5 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3144

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=95A25FC6EC75732ADDC54EB8130C957E --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:876

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2DDDDD7EC96A1554C6116EA8096502ED --mojo-platform-channel-handle=2420 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:740

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1D34AECCEEDB14C928DA461DF84393B2 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1D34AECCEEDB14C928DA461DF84393B2 --renderer-client-id=6 --mojo-platform-channel-handle=2060 --allow-no-sandbox-job /prefetch:1
3⤵
PID:3408

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B71F626EE7E82AE0D2BF18F0D9BA0713 --mojo-platform-channel-handle=2008 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
8893cf274b3afbd9f0c55c3cc457fec1

SHA1
208d3f9502270b9376ce019d0ff8677d83865ebd

SHA256
996a1bf5220fd9b857885c5bbaf7d28e629d4a8ba0b16b6116552856fdffbc95

SHA512
e5df91cec4bdf3d3682bf457672c931ef597582ee32a068fd00dd8743b9043888e4a31f4654d17246e0630194af362f79f12cfb9d44e3f383f60f30f346ca78e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
6eee9ecc54e45297a38be1956b979e92

SHA1
6590bbeb18667b254889930343d26e1b267f47c0

SHA256
f43860e0a28fe7dddac93d837913ecc01b169d69f1fe67bc56dda876dc1923c8

SHA512
c17b278cb3f664efa285cbdea280ff81fb42b95dcf347709aeab742ef4f92b0f837000ae542e221c8e82a246ceef5b71b6a2775dd64bb112a315dde0d210017e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads